Ports, IP Addresses, and Hostnames to Allow
In your network, you must add the hostnames and ports of various parts of Anypoint Platform to your allowlist to enable the Runtime Manager agent in a customer-hosted Mule runtime engine to communicate with the online Anypoint Platform APIs and services managed by MuleSoft.
Endpoints
These endpoints use mutual TLS (mTLS) authentication:
-
runtime-manager.anypoint.mulesoft.com
-
runtime-manager.eu1.anypoint.mulesoft.com
-
runtime-manager.gov.anypoint.mulesoft.com
-
data-authenticator.anypoint.mulesoft.com
-
data-authenticator.gov.anypoint.mulesoft.com
-
us1.ingest.mulesoft.com
-
eu1.ingest.mulesoft.com
The *.ingest.mulesoft.com:8443 endpoint uses Mutual TLS (mTLS) for direct agent-to-platform certificate authentication. Configure your firewall or network proxy to allow SSL passthrough — do not enable deep packet inspection (DPI) or SSL decryption for this traffic. Ensure proxy rules also permit outbound TCP on port 8443 in addition to standard port 443.
|
These endpoints use WebSockets:
-
runtime-manager.anypoint.mulesoft.com
-
runtime-manager.eu1.anypoint.mulesoft.com
-
runtime-manager.gov.anypoint.mulesoft.com
| Ports, IP addresses, and hostnames are required for outbound connectivity. Inbound connectivity is not required to your network and servers. The connection between customer-hosted Mule runtime and Anypoint Platform is established via persistent Websocket connections. All connections are outbound. |
WebSocket Connection Requirements
The Mule runtime agent maintains a persistent WebSocket connection over HTTPS (WSS port 443) to Anypoint Runtime Manager. To maintain agent communication, configure your network infrastructure to allow this connection.
Preventing Idle Timeout Disconnections
Configure network proxies and firewalls to prevent idle timeouts from terminating WebSocket connections. Enabled idle timeouts on your network infrastructure can cause the agent to disconnect unexpectedly from Runtime Manager. To prevent agent disconnections:
-
Disable idle timeouts on your firewall and proxy servers for connections to
runtime-manager.anypoint.mulesoft.comand regional variants. -
Configure keep-alive mechanisms to maintain the connection during inactive periods.
-
Work with your network administrator to ensure that proxy and firewall policies allow persistent connections.
Bypassing SSL/TLS Inspection
Configure your network proxies and firewalls to bypass SSL/TLS inspection for WebSocket connections to Anypoint Platform endpoints. Enable SSL passthrough for these hostnames:
-
anypoint.mulesoft.com -
runtime-manager.anypoint.mulesoft.com -
Regional variants, such as
runtime-manager.eu1.anypoint.mulesoft.comandruntime-manager.gov.anypoint.mulesoft.com
|
Don’t enable SSL/TLS decryption or deep packet inspection for these WebSocket connections. If you intercept or modify the SSL/TLS handshake, the agent fails authentication with Runtime Manager. Configure your firewall rules to explicitly allow SSL passthrough for Anypoint Platform endpoints. |
Handling Transient Network Disconnections
Brief network disruptions can cause temporary disconnection alerts in Runtime Manager. However, the Mule runtime agent reconnects automatically when network connectivity returns. Expect this behavior during network disruptions:
-
Brief network interruptions trigger temporary disconnection alerts.
-
The agent attempts to reestablish the WebSocket connection automatically.
-
When connectivity is restored, the agent reconnects and resumes normal operation.
-
Persistent disconnections lasting longer than a few minutes require network or firewall investigation.
For more information on configuring agent communication through proxy servers, see Connect the Agent Through a Proxy Server.
Ports
Starting with Runtime Manager Agent 2.7.0 (Anypoint Monitoring Agent 2.7.1+), Mule runtimes stream telemetry metrics using an OpenTelemetry-based exporter. This requires outbound access to *.ingest.mulesoft.com on port 8443.
|
| Region | Name | Port |
|---|---|---|
US |
anypoint.mulesoft.com |
443 |
US |
runtime-manager.anypoint.mulesoft.com |
443 |
US |
analytics-ingest.anypoint.mulesoft.com |
443 |
US |
data-authenticator.anypoint.mulesoft.com |
443 |
US |
exchange-files.anypoint.mulesoft.com |
443 |
US |
exchange2-asset-manager-kprod.s3.amazonaws.com |
443 |
US |
us1.ingest.mulesoft.com |
8443 |
US-GOV |
runtime-manager.gov.anypoint.mulesoft.com |
443 |
US-GOV |
data-authenticator.gov.anypoint.mulesoft.com |
443 |
US-GOV |
gov.anypoint.mulesoft.com |
443 |
US-GOV |
exchange-files.gov.anypoint.mulesoft.com |
443 |
US-GOV |
exchange2-asset-manager-kgprod.s3.us-gov-west-1.amazonaws.com |
443 |
EU |
eu1.anypoint.mulesoft.com |
443 |
EU |
runtime-manager.eu1.anypoint.mulesoft.com |
443 |
EU |
analytics-ingest.eu1.anypoint.mulesoft.com |
443 |
EU |
data-authenticator.eu1.anypoint.mulesoft.com |
443 |
EU |
exchange2-asset-manager-kprod-eu.s3.eu-central-1.amazonaws.com |
443 |
EU |
eu1.ingest.mulesoft.com |
8443 |
Static IP Addresses
| As part of our continuous infrastructure improvement, MuleSoft introduces a new set of static IP addresses in Runtime Manager to augment existing ones. To avoid service disruption, allow the IP addresses or domains, depending on your network policy, through your organization’s firewall before February 1st, 2024, as listed below. |
-
Allowlist these static IPs in the
USregion to access theruntime-managerhosts:Region Name IP Address US
runtime-manager.anypoint.mulesoft.com
18.214.68.14
US
runtime-manager.anypoint.mulesoft.com
35.174.151.175
US
runtime-manager.anypoint.mulesoft.com
18.213.137.40 (Starting Feb 2024)
US
runtime-manager.anypoint.mulesoft.com
34.232.255.44 (Starting Feb 2024)
US
runtime-manager.anypoint.mulesoft.com
44.209.29.79 (Starting Feb 2024)
-
Allowlist these static IPs in the
EUregion to access theruntime-managerhosts:Region Name IP Address EU
runtime-manager.eu1.anypoint.mulesoft.com
18.185.141.77
EU
runtime-manager.eu1.anypoint.mulesoft.com
3.123.216.217
EU
runtime-manager.eu1.anypoint.mulesoft.com
3.127.253.183 (Starting Feb 2024)
Dynamic IP Addresses
Some of the IP addresses used by Anypoint Platform services are assigned automatically by the underlying cloud infrastructure. Because these are dynamic, do not implement an allowlist based on the specific IP addresses assigned to Anypoint services.
Many firewall devices allow you to define Layer 7 firewall rules so that you can filter by destination name or application type.
Include the following fully qualified hostnames in your Layer 7 firewall rules:
| Region | Hostname |
|---|---|
US |
anypoint.mulesoft.com |
US |
analytics-ingest.anypoint.mulesoft.com |
US |
data-authenticator.anypoint.mulesoft.com |
US |
us1.ingest.mulesoft.com |
US-GOV |
runtime-manager.gov.anypoint.mulesoft.com |
US-GOV |
data-authenticator.gov.anypoint.mulesoft.com |
US-GOV |
gov.anypoint.mulesoft.com |
EU |
eu1.anypoint.mulesoft.com |
EU |
analytics-ingest.eu1.anypoint.mulesoft.com |
EU |
data-authenticator.eu1.anypoint.mulesoft.com |
EU |
eu1.ingest.mulesoft.com |
Allowlist
Allowlist the following URLs, the valid Agents are only 2.2.0+:
| URL | Description |
|---|---|
runtime-manager.anypoint.mulesoft.com |
Connection for ARM management capabilities (public-cert agents) |
data-authenticator.anypoint.mulesoft.com |
Connection to the metrics ingestion service of arm-monitoring stack (public-cert agents) |